Apply Virtual Scope logic to all existing scope types

Extend every existing RBAC scope type (SystemScope, DomainScope, ProjectScope, UserScope, StorageHost, ContainerRegistry, ScalingGroup) to resolve ownership through the Virtual Scope chain (scope -> virtual_scope -> entity) introduced by BA-6567, instead of the current direct scope -> entity model.

Scope
- Update scope resolution logic for every existing scope type to consult virtual_scopes / scope_bindings / entity_memberships.
- Ensure any entity that can own other entities gets a virtual scope created alongside it, together with a self scope_binding (owner scope -> its own VS), owned by the RBAC ops provider grant method.
- Update permission-check code paths (repositories, services) that currently assume direct association_scopes_entities lookups.

Depends on BA-6567 (Virtual Scope model/BEP), BA-6604/BA-6605/BA-6606 (VS DB tables/ops/permission verification).

[Aligned to BEP-1062 (#12842): table names are virtual_scopes / scope_bindings / entity_memberships (previously scope_virtual / virtual_entity, which do not exist in code); ownership resolves via a self scope_binding on each owner VS so it uses the same single non-recursive path; the auto/ref distinction is removed. NOTE: current children cover Domain/Project/Container Registry/Resource Group only - User/StorageHost/System scope children may still be needed per the scope set above.]

JIRA Issue: BA-6656

Start with BEP-1062 and the BA-6567/BA-6604/BA-6605/BA-6606 dependency work, then trace the repositories and services that still use direct association_scopes_entities lookups. Done means every listed scope type resolves through virtual_scopes, scope_bindings, and entity_memberships, with required owner self-bindings and updated permission checks.

Written by the indexing model from the issue text.